The AI Said the Endpoint Was Vulnerable. It Was Wrong.

Описание и применение

LLM ускоряет обзор кода, но может выдавать ложные срабатывания из‑за отсутствия контекста. Необходимо вручную проверять каждое найденное уязвимое место.

Задача

Using an LLM to review code in isolated chunks can produce false positives because the model lacks a persistent view of the entire call graph.

Результат

The LLM accelerated the review process but produced false positives; manual verification was essential to ensure accurate findings.

Рабочий процесс

• Paste batches of code into the LLM overnight
• Receive a ranked list of likely vulnerable functions
• Identify flagged items (e.g., SSRF)
• Manually verify each flagged item by tracing call paths and reproducing behavior
• Cross‑check any CVE IDs, version strings, or CVSS scores against real advisories
• Incorporate only verified findings into the final report

Доказательства

By morning there's a ranked list: twelve "likely vulnerable" functions, one flagged in bold as SSRF via a URL parameter passed straight into an internal HTTP client. It reads like a finding. It's already in the report draft.

Источник

The workflow that actually holds up treats the model as a hypothesis generator, never as the tester of record.

Источник